Add profile for luarocks #4596

matu3ba · 2021-10-07T20:45:18Z

DO NOT MERGE! Please review.

MERGE BLOCKER: firecfg does not create the necessary symlink in
/usr/local/bin
/usr/bin/luarocks however is a proper working binary.

Another annoyance from this: Neovim has a package manager called packer,
which pollutes $HOME with manifest-5-[1-4].zip and a pile of .rockspec
and .src.rock files.

DO NOT MERGE! Please review. MERGE BLOCKER: firecfg does not create the necessary symlink in /usr/local/bin /usr/bin/luarocks however is a proper working binary. Another annoyance from this: Neovim has a package manager called packer, which pollutes $HOME with manifest-5-[1-4].zip and a pile of .rockspec and .src.rock files.

matu3ba · 2021-10-07T20:47:08Z

If anyone has an idea that would be great. I do also have a profile for neovim that depends on luarocks working properly.

I noticed the same issue for vim: /usr/local/bin is not created for me. With firejail vim /var/log/pacman.log an empty file is opened. Even though vim is in /usr/bin/vim.

smitsohu · 2021-10-07T23:31:16Z

Closed by accident!

If you create the symbolic link manually, does it work as expected?

sudo ln -s /usr/bin/firejail /usr/local/bin/luarocks

In other words, is this an issue with firecfg or an issue with the sandbox?

rusty-snake · 2021-10-08T06:03:02Z

firecfg does not create the necessary symlink in /usr/local/bin
I noticed the same issue for vim: /usr/local/bin is not created for me.

If you do not add luarocks to firecfg.config, firecfg will not create symlinks.

rusty-snake

A first review (without hardening suggestions).

etc/profile-a-l/luarocks.profile

Co-authored-by: rusty-snake <[email protected]>

rusty-snake

Second round, hardening suggestions.

etc/profile-a-l/luarocks.profile

noblacklist in allow-lua.inc must corresponds to blacklist section for lua in disable-interpreters.inc

Co-authored-by: rusty-snake <[email protected]>

etc/inc/allow-lua.inc

etc/inc/disable-interpreters.inc

* disable /run/user/userid * use well tested whitelist-usr-share-common.inc * use disable-X11.inc

* dont break various application sandboxes with noblacklist /usr/include/lua* Instead insert it manually for luarocks. * remove redundant `blacklist /usr/share/lua` from disable-interpreters.inc

etc/profile-a-l/luarocks.profile

matu3ba · 2021-10-08T12:59:16Z

@rusty-snake Can I rebase, squash and force-push with you as co-author and the following text or do you think more changes are needed?

Add profile for luarocks

Co-authored-by: rusty-snake <[email protected]>

rusty-snake · 2021-10-08T13:07:57Z

src/firecfg/firecfg.config

@@ -481,6 +481,7 @@ lowriter
 # lrzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrztar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrzuntar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
+luarocks


Needs discussion: Do we want to firecfg build-systems/package-managers by default? (related: #4519)

Status quo of the default profile is very undesirable, because luarocks search does not update the package list.
Both options are annoying to some degree:

If sandboxed on default, luarocks may have too few privileges to invoke external compilers ie to compile luaformat

If not sandboxed, evil lua programs/plugins in neovim may trivially invoke luarocks to do bad stuff.

rusty-snake · 2021-10-08T13:08:32Z

etc/inc/allow-lua.inc

-noblacklist /usr/share/lua
 noblacklist /usr/share/lua*


I need to check why there was these two.

rusty-snake · 2021-10-08T13:14:57Z

etc/profile-a-l/luarocks.profile

+# Disallow blocking access to Lua header files.
+noblacklist /usr/include/lua*


#4596 (comment)

When is /usr/include/lua… used? Current behaviour of allow-lua.inc is strange, allow /usr/include but not /usr/include/lua*.

Currently this is how we handle /usr/include:

$ grep /usr/include /etc/firejail/* /etc/firejail/allow-lua.inc:noblacklist /usr/include /etc/firejail/allow-nodejs.inc:noblacklist /usr/include/node /etc/firejail/allow-python2.inc:noblacklist /usr/include/python2* /etc/firejail/allow-python3.inc:noblacklist /usr/include/python3* /etc/firejail/disable-devel.inc:blacklist /usr/include /etc/firejail/disable-interpreters.inc:blacklist /usr/include/lua* /etc/firejail/disable-interpreters.inc:blacklist /usr/include/node /etc/firejail/disable-interpreters.inc:blacklist /usr/include/python2* /etc/firejail/disable-interpreters.inc:blacklist /usr/include/python3* /etc/firejail/hashcat.profile:noblacklist /usr/include

rusty-snake · 2021-10-08T13:15:16Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Missing mkdir/mkfile for some of them.

rusty-snake · 2021-10-08T13:15:45Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Missing blacklist/noblacklist/read-only for some of them.

rusty-snake · 2021-10-08T13:16:09Z

etc/profile-a-l/luarocks.profile

+
+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts


Is this necessary?

edit: this line: whitelist ${HOME}/.wget-hsts

rusty-snake · 2021-10-08T13:16:26Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Needs discussion: Missing wc.

rusty-snake · 2021-10-08T13:17:04Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.netrc
+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external
+whitelist ${HOME}/.nix-profile/bin
+whitelist ${HOME}/.luarocks
+whitelist ${HOME}/.config/luarocks


Needs discussion: Do we want to use whitelisting for package-managers/build-systems by default.

rusty-snake · 2021-10-08T13:18:56Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external


Nothing else from ~/luarocks required?

The answer to this question depends on "Needs discussion: Do we want to firecfg build-systems/package-managers by default? (related: #4519)".
To what degree does firejail want to allow invoking build systems or running stuff from a package manager (which sounds like bad security practice).

matu3ba · 2022-05-05T10:10:23Z

User experience:
building neovim, which builds packer to invoke it fails with:

cd /home/user/dev/git/c/neovim/.deps && /home/user/dev/git/c/neovim/.deps/usr/bin/luarocks build nvim-client 0.2.3-1 CC=/usr/bin/cc LD=/usr/bin/cc

Error: Could not find a result named nvim-client 0.2.3-1: No results matching query were found for Lua 5.1.
To check if it is available for other Lua versions, use --check-lua-versions.
[user@pc .deps]$ cd /home/user/dev/git/c/neovim/.deps && /home/user/dev/git/c/neovim/.deps/usr/bin/luarocks install nvim-client 0.2.3-1 CC=/usr/bin/cc LD=/usr/bin/cc

There is a manifest.zip file written to $HOME, which contains this info. Also $HOME is cluttered with *src.rock and *.rockspec files.

matu3ba

ups, I forgot to click "Submit review".

etc/profile-a-l/luarocks.profile

matu3ba · 2022-05-05T10:02:30Z

src/firecfg/firecfg.config

@@ -481,6 +481,7 @@ lowriter
 # lrzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrztar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # lrzuntar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
+luarocks


Status quo of the default profile is very undesirable, because luarocks search does not update the package list.
Both options are annoying to some degree:

If sandboxed on default, luarocks may have too few privileges to invoke external compilers ie to compile luaformat

If not sandboxed, evil lua programs/plugins in neovim may trivially invoke luarocks to do bad stuff.

matu3ba · 2022-05-05T10:05:21Z

etc/profile-a-l/luarocks.profile

+whitelist ${HOME}/.config/pkcs11
+whitelist ${HOME}/.wget-hsts
+whitelist ${HOME}/.cache/luarocks
+whitelist ${HOME}/luarocks/cmd/external


The answer to this question depends on "Needs discussion: Do we want to firecfg build-systems/package-managers by default? (related: #4519)".
To what degree does firejail want to allow invoking build systems or running stuff from a package manager (which sounds like bad security practice).

smitsohu closed this Oct 7, 2021

smitsohu reopened this Oct 7, 2021

rusty-snake marked this pull request as draft October 8, 2021 06:04

rusty-snake requested changes Oct 8, 2021

View reviewed changes

matu3ba and others added 5 commits October 8, 2021 08:54

use allow-lua as its smaller.

eb7dab0

Co-authored-by: rusty-snake <[email protected]>

remove disable-write-mnt

4e670d2

Co-authored-by: rusty-snake <[email protected]>

shortening (default-disabled) private-etc

5df4c63

Co-authored-by: rusty-snake <[email protected]>

remove private-bin and s/allow/whitelist

f6f0021

add luarocks to firecfg.config

65242d9

rusty-snake reviewed Oct 8, 2021

View reviewed changes

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

etc/profile-a-l/luarocks.profile Show resolved Hide resolved

matu3ba and others added 2 commits October 8, 2021 09:35

fix allow-lua.inc and disable-interpreters.inc

4c5ca65

noblacklist in allow-lua.inc must corresponds to blacklist section for lua in disable-interpreters.inc

add seccomp.block-secondary

161df63

Co-authored-by: rusty-snake <[email protected]>

rusty-snake requested changes Oct 8, 2021

View reviewed changes

etc/inc/allow-lua.inc Outdated Show resolved Hide resolved

etc/inc/disable-interpreters.inc Outdated Show resolved Hide resolved

matu3ba added 3 commits October 8, 2021 10:00

update luarocks profile

29ef011

* disable /run/user/userid * use well tested whitelist-usr-share-common.inc * use disable-X11.inc

Merge branch 'luarocks' of github.com:matu3ba/firejail into luarocks

e610d2e

update luarocks profile

f3e9ea0

* dont break various application sandboxes with noblacklist /usr/include/lua* Instead insert it manually for luarocks. * remove redundant `blacklist /usr/share/lua` from disable-interpreters.inc

rusty-snake reviewed Oct 8, 2021

View reviewed changes

etc/profile-a-l/luarocks.profile Outdated Show resolved Hide resolved

matu3ba added 2 commits October 8, 2021 10:41

add whitelist-var-common and whitelist-run-common

ce1b231

fix order

1d1f524

rusty-snake reviewed Oct 8, 2021

View reviewed changes

rusty-snake reviewed Oct 9, 2021

View reviewed changes

matu3ba commented Jul 25, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add profile for luarocks #4596

Add profile for luarocks #4596

matu3ba commented Oct 7, 2021

matu3ba commented Oct 7, 2021 •

edited

Loading

smitsohu commented Oct 7, 2021 •

edited

Loading

rusty-snake commented Oct 8, 2021

rusty-snake left a comment

rusty-snake left a comment

matu3ba commented Oct 8, 2021

rusty-snake Oct 8, 2021

matu3ba May 5, 2022

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021 •

edited

Loading

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

rusty-snake Oct 8, 2021

matu3ba May 5, 2022

matu3ba commented May 5, 2022

matu3ba left a comment

matu3ba May 5, 2022

matu3ba May 5, 2022

		# Disallow blocking access to Lua header files.
		noblacklist /usr/include/lua*

Add profile for luarocks #4596

Are you sure you want to change the base?

Add profile for luarocks #4596

Conversation

matu3ba commented Oct 7, 2021

matu3ba commented Oct 7, 2021 • edited Loading

smitsohu commented Oct 7, 2021 • edited Loading

rusty-snake commented Oct 8, 2021

rusty-snake left a comment

Choose a reason for hiding this comment

rusty-snake left a comment

Choose a reason for hiding this comment

matu3ba commented Oct 8, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rusty-snake Oct 8, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

matu3ba commented May 5, 2022

matu3ba left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

matu3ba commented Oct 7, 2021 •

edited

Loading

smitsohu commented Oct 7, 2021 •

edited

Loading

rusty-snake Oct 8, 2021 •

edited

Loading